[PATCH] Fix segfault in maybe_script_execute.

[Stefan Liebler]

On 09/06/2018 11:14 AM, Andreas Schwab wrote:
> On Sep 06 2018, Stefan Liebler <stli@linux.ibm.com> wrote:
> 
>> commit 6359e1c59f856a1115fdbcfa233052ac62e32c83
>> Author: Stefan Liebler <stli@linux.ibm.com>
>> Date:   Thu Sep 6 11:03:38 2018 +0200
>>
>>      Fix segfault in maybe_script_execute.
>>      
>>      If glibc is built with gcc 8 and -march=z900,
>>      the testcase posix/tst-spawn4-compat crashes with a segfault.
>>      
>>      In function maybe_script_execute, the new_argv array is dynamically
>>      initialized on stack with (argc + 1) elements.
>>      The function wants to add _PATH_BSHELL as the first argument
>>      and writes out of bounds of new_argv.
>>      
>>      In case of argc == 1, it writes three instead of two elements:
>>      new_argv[0] = (char *) _PATH_BSHELL;
>>      new_argv[1] = (char *) args->file;
>>      new_argv[2] = NULL;
>>      
>>      The latter write access writes to the same location where the
>>      pointer args is stored on stack.  Then it segfaults while accessing args:
>>      args->exec (new_argv[0], new_argv, args->envp);
>>      
>>      In case of argc > 1, new_argv[0] and new_argv[1] are set in the same
> 
> This still make a difference between argc == 1 and argc > 1.  Just say
> that there is an off-by-one because maybe_script_execute fails to count
> the terminating NULL when sizing new_argv.
> 
> Andreas.
> 
What about this?

Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 20180906_1230_maybe_script_execute.patch
Type: text/x-patch
Size: 1326 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20180906/7edbd031/attachment.bin>